PT-2018-4649 · Symantec · Symantec Advanced Secure Gateway+1

Published 2018-01-10 · Updated 2021-07-08 · CVE-2016-10257

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Symantec Advanced Secure Gateway (ASG) versions 6.6 through 6.7.2.1 Symantec ProxySG versions 6.5 through 6.5.10.6 Symantec ProxySG versions 6.6 through 6.7.2.1

Description The management console of the affected software is susceptible to a reflected XSS issue. A remote attacker can use a crafted management console URL in a phishing attack to inject arbitrary JavaScript code into the management console web client application.

Recommendations For Symantec Advanced Secure Gateway (ASG) versions 6.6 through 6.7.2.1, update to version 6.7.2.1 or later. For Symantec ProxySG versions 6.5 through 6.5.10.6, update to version 6.5.10.6 or later. For Symantec ProxySG versions 6.6 through 6.7.2.1, update to version 6.7.2.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-10257

Affected Products

Symantec Advanced Secure Gateway

Symantec Proxysg

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-10257 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10257 · Vendor Advisory
• https://symantec.com/security-center/network-protection-security-advisories/SA155 · Vendor Advisory
• http://securityfocus.com/bid/102447 · Note
• http://securitytracker.com/id/1040138 · Note
• https://t.me/cvenotify/17263 · Telegram Post